NEAS[.]c1a43e13aa5659c299e79d3d49be33a0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c1a43e13aa5659c299e79d3d49be33a0.exe
Size

320KB
MD5

c1a43e13aa5659c299e79d3d49be33a0
SHA1

78c48beb20ad59d335460bf4fd74009c86e57217
SHA256

20408280b15f55f88dfe49df167429595e957f9f15258d8cc70870ba4511723f
SHA512

a1d8c058df0c58343c77d84dcf42a33a579b9bdb4ab82fd2e67794ae1637e13b0502ae84bc468ccde1a97ec21efd9e5cd9a18c186b600faf93067cded26a7d82
SSDEEP

6144:GZYpm0GqrH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:59j2EB0NxDIBuOFe7/uT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c1a43e13aa5659c299e79d3d49be33a0.exe

Files

NEAS.c1a43e13aa5659c299e79d3d49be33a0.exe
.exe windows:4 windows x86

6be7d3639adaf6850d89cbe531bea42c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCommandHistoryW
GetLastError
TlsFree
ExpandEnvironmentStringsA
DeleteFiber
FillConsoleOutputCharacterA
FatalExit
MoveFileW
SetHandleContext
ReleaseMutex
LockResource
SetConsoleInputExeNameA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tc
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE